ISMS Copilot
Your compliance expert,
inside your AI.
ISMS Copilot brings what hundreds of consulting projects taught us into ChatGPT, Claude and the tools your team already uses, or works on its own. ISO 27001, SOC 2, GDPR, NIS 2 and more.
Ask the expert from the AI you already use
Connect ISMS Copilot once. When a question needs a compliance expert, your AI asks it and brings back an answer built for your client.
Claude asks ISMS Copilot what the policy must cover, then writes it as a document you can send. Real session, demo account, sped up.
How to connect your AIConnect once
Add ISMS Copilot to Claude, ChatGPT or your agent and sign in. Every plan, including Free.
Your AI asks when it matters
It calls the expert when the framework has to be right, then keeps working with the answer.
Or use our app
Each client gets its own workspace, so context never mixes between projects.
Our knowledge agents check the rules against official sources.
Agents re-check our framework library against official sources. Every update is reviewed before it ships, and anything unclear goes to a person.
Real checks by our knowledge agents in the last 30 days, across regions.
General AI aloneKnowledge frozen at a training date
With ISMS CopilotChecked against official sources by our knowledge agents
General AI aloneBroad general knowledge
With ISMS CopilotCurated compliance knowledge, built to refuse rather than guess
General AI aloneDepends on the model and what you supply
With ISMS CopilotA maintained library of 104+ frameworks
General AI aloneReads and summarizes any document
With ISMS CopilotCompliance-focused gap analysis and control mapping
frameworks and regulations worldwide. Version-aware, and kept up to date.
Who uses ISMS Copilot
Compliance work
Independent consultants
A senior colleague on every client: policies, gap analyses and audit prep, one workspace per client.
For consultantsConsultancies
The whole team on one expert, client work that belongs to the firm, and more clients with the same people.
For consultanciesIn-house compliance teams
Answers between audits without waiting for the consultant, inside the AI your people already use.
For compliance teamsAuditors and certification bodies
Check a requirement, map frameworks or train new auditors, without advising the clients you certify.
For auditorsBuilding with AI
4 billion+tokens processed
130,000+messages
University information security team
United Kingdom
2,700+messages sent
ISO 27001 and IT-Grundschutz consultancy
Germany
2,100+messages sent
Data protection and ISO consultancy
Austria
1,900+messages sent, across 30+ client workspaces
GRC consultancy
Belgium
400+messages sent, across client workspaces
Selected customers, anonymous. Counts to date, rounded down.
An excellent on-hand consultancy-like assistant to sanity check my own knowledge and enhance any ISMS initiatives and daily work.
IT and Security Manager, research institution, UK. ISO 27001 certified.
It doesn't just explain standards, it actually helps you do the work. Far more relevant than generic AI tools.
Drishti Thakkar, GRC and AI security
A massive time-saver for ISO 27001 prep. It excels at identifying documentation gaps and streamlining the Risk Treatment Plan.
John Gilchrist, IT Audit Manager, airline industry
We protect your data like it's our own
You handle other companies' sensitive work. Here is how we handle yours.
Your conversations, documents and compliance information are never used to train AI models.
Your data is stored in the EU (Frankfurt) and protected by GDPR-compliant privacy controls.
Mandatory MFA, encryption in transit and at rest, row-level database security and regular vulnerability scanning.
- ISO 27001
- ISO 27701
- ISO 42001
- ISO 9001
- ISO 22301
- UN R155
- NIS 2
- DORA
- GDPR
- EU AI Act
- EASA Part-IS
- AIUC-1
- EN 18286
- TISAX
- CRA
- SOC 2
- NIST CSF
- NIST 800-171 / CMMC
- NIST 800-53
- HIPAA
- CCPA / CPRA
- UK GDPR
- UK DPA 2018
- UK DUA 2025
- UK FOIA 2000
- UK EIR 2004
- Cyber Essentials
- NCSC CAF
- NIS 2 Germany
- BSI IT-Grundschutz
- BSI C5
- HDS
- SecNumCloud
- ENS
- BIO
- NIS 2 Belgium
- CyberFundamentals
- NISG 2026
- Essential Eight
- Privacy Act 1988
- ISO/IEC 27002:2022
- ISO/IEC 27017
- ISO/IEC 27018:2025
- NIST AI RMF
- NIST SP 800-207
- NIST SP 800-218 (SSDF)
- NIST SP 800-66 Rev. 2
- NIST Privacy Framework
- CMMC 2.0
- FedRAMP
- FINMA RS 23/1
- FADP
- Switzerland ICT Minimum Standard
- Ireland DPA 2018
- ЗКС
- Ν. 60(Ι)/2025
- Zákon č. 264/2025 Sb.
- NIS 2-loven
- KüTS
- Kyberturvallisuuslaki 124/2025
- France NIS 2
- Ν. 5160/2024
- Zakon o kibernetičkoj sigurnosti
- 2024. évi LXIX. törvény
- Ireland NIS 2
- D.Lgs. 138/2024
- Kibernetinio saugumo įstatymas
- NKDL
- S.L. 460.41
- UKSC
- RJC (DL 125/2025)
- OUG 155/2024
- Cybersäkerhetslag (2025:1506)
- ZInfV-1
- Zákon č. 69/2018 Z. z.
- PIPEDA
- Alberta PIPA
- BC PIPA
- OSFI B-13
- Loi 25
- DPDPA
- CERT-In Directions 2022
- RBI IT Governance
- SEBI CSCRF
- PCI DSS 4.0
- CIS Controls v8.1
- Singapore PDPA
- MAS TRM
- Japan APPI
- COBIT 2019
- ISO 19011:2026
- NIS Regulations 2018
- UAVG
- NEN 7510
- NCS
- DigiD Normenkader
- ISO/IEC 27000:2026
- Belgian DPA 2018
- BDSG
- IRDAI Cyber Security Guidelines
- My Number Act
- METI Cybersecurity Management Guidelines
- DORA RTS on ICT Risk Management
- NIS 2 Implementing Regulation
- 104+ frameworks in the catalogue
Simple, transparent pricing.
Free
$0
Try the full product on the 7-day Plus trial, no card. The free plan is what you keep after: fast model, 10 messages per 4 hours.
Plus
$24/ month
Or $240 billed annually.
Enough for daily compliance work. For individual consultants and small teams.
Standard
$50/ month
Or $500 billed annually.
More room to grow. For consultants and small teams scaling their compliance work.
Pro
$100/ month
Or $1,000 billed annually.
Extended usage for heavy workloads. For power users and busy consultancies.
Questions
What is ISMS Copilot?
ISMS Copilot is a specialized AI assistant for information security compliance professionals, built for ISO 27001, SOC 2, NIST, and other compliance frameworks, grounded in curated compliance knowledge and built to refuse rather than guess. It does not replace ChatGPT or Claude: use both. Keep your general assistant or coding agent for everything else, and bring in ISMS Copilot for the compliance work, side by side in the chat app or over MCP from Claude Code, Cursor or Codex. Builders can also use the same compliance engine through the live text-only OpenAI-compatible API or an embeddable assistant.
How is ISMS Copilot different from ChatGPT?
Use both. A general assistant such as ChatGPT or Claude is good at everyday writing, reasoning and code. ISMS Copilot adds a GRC specialist grounded in curated framework knowledge, your workspaces and your company context. You can use them side by side, or connect ISMS Copilot over MCP to ChatGPT, claude.ai, Claude Desktop or your coding agent (Claude Code, Cursor, Codex).
Is ISMS Copilot a GRC platform?
No. ISMS Copilot does not collect evidence or continuously monitor controls. It is the judgment and agent layer teams use alongside their GRC platform (or instead of one for the writing and thinking work), available through chat, API, MCP, and embed.
Who is ISMS Copilot for?
ISMS Copilot is designed for cybersecurity professionals, compliance consultants, auditors, and organizations implementing frameworks like ISO 27001, SOC2, and NIST. Whether you're a solo consultant managing multiple clients or part of an enterprise security team, ISMS Copilot helps you work faster and deliver better results.
Which compliance frameworks do you support?
ISMS Copilot has curated knowledge for 104+ compliance frameworks across 19 jurisdictions, including ISO 27001, SOC 2, GDPR, NIS 2, DORA, HIPAA, NIST CSF, EU AI Act, ISO 42001, and country-specific transpositions like TISAX (Germany), HDS (France), and ENS (Spain). New frameworks land roughly every 1–2 weeks. The full list, including which tier of coverage each framework gets, lives at ismscopilot.com/frameworks.
How much does it cost?
ISMS Copilot Chat is free to try. Paid chat plans start at $20/month, with team plans for organizations managing multiple compliance projects. API and Embed use separate pricing shown on their product pages.
Is my data secure?
Yes. We implement enterprise-grade security including encryption in transit and at rest, mandatory MFA, row-level database security, and regular vulnerability scanning. Your data is stored in the EU (Frankfurt) and protected by GDPR-compliant privacy controls.
Do you train AI models on my data?
Absolutely not. Your conversations, documents, and compliance information are never used to train AI models. Your data remains completely private and is not shared with AI training datasets.
Bring the expert into your AI.